Prediction of drive-by download attacks on Twitter

Abstract

The popularity of Twitter for information discovery, coupled with the automatic shortening of URLs to save space, given the 140 character limit, provides cyber criminals with an opportunity to obfuscate the URL of a malicious Web page within a tweet. Once the URL is obfuscated the cyber criminal can lure a user to click on it with enticing text and images before carrying out a cyber attack using a malicious Web server. This is known as a drive-bydownload. In a drive-by-download a user's computer system is infected while interacting with the malicious endpoint, often without them being made aware the attack has taken place. An attacker can gain control of the system by exploiting unpatched system vulnerabilities and this form of attack currently represents one of the most common methods employed. In this paper we build a machine learning model using machine activity data and tweet meta data to move beyond post-execution classification of such URLs as malicious, to predict a URL will be malicious with 99.2% F-measure (using 10-fold cross validation) and 83.98% (using an unseen test set) at 1 second into the interaction with the URL. Thus providing a basis from which to kill the connection to the server before an attack has completed and proactively blocking and preventing an attack, rather than reacting and repairing at a later date.

Emotions Behind Drive-by Download Propagation on Twitter

“…Thus, giving us 6,122 malicious sample across seven sporting events and a malicious log containing millions of rows of machine activity. The collected malware sample when compared to previous studies, like by Moser et al [40] (308 malware sample), Ahmadi et al [1] (806 malware sample) and Naval et al [41] (2,435 malware sample), was a bigger and diverse sample that was collected over a period of three years and was used to built a drive-by download prediction model [28].…”

“…Number of user mentions were used because an adversary could make their post visible to an influential user that has high number of follower by mentioning them in their post. Similarly, age of account was chosen because it has been used as a parameter to identify tweets containing malicious URLs [28]. Both emotion and sentiment were chosen because they have in the past been used to understand propagation of post [5].…”

“…Twitter's popularity continues to attract cybercriminals to carry out various cyber attacks. Cyber attacks such as distributed denial of service [32], cross-site scripting [22], Trojan attacks [42] and drive-by downloads [28] continue to be major threats on Twitter.…”

A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems

“…Drive-by or download (FIGURE 4-3.6) is another software threat that requires no action from the user, however, the malicious code is automatically downloaded. It contributed to 48% of all web-based attacks in 2017 [87], [88] and is considered one of the main threats in 2019 [89]. Fingerprinting (FIGURE 4 -3.3) and misconfiguration are also forms of software threats.…”

Processing social media in real-time

“…This special issue covers a wide range of applications that rely on real-time processing of social media, including event detection [8,14,7], cybersecurity [10], opinion mining [5] and automatic geo-localization [7]. The diversity of submissions received shows the need for furthering research in processing social media streams in a (near) real-time.…”